Privacy Notice

Operator and contact details

Name

Vágó Péter János e.v.

Registered address

1124 Budapest, Lejtő út 4.

Tax number / registration

41852718-1-43 · 58098091

Customer support

v.peter@smartsquareproductions.com

Customer support telephone

+36 70 672 8020

Privacy contact

vproperty.hu@gmail.com

Contact form

We process the name, email address, subject and message entered in the homepage's 'Get in touch' form to respond to your enquiry. The operator is the data controller. The legal basis for an enquiry preparing a contract is GDPR Article 6(1)(b); for other customer support questions, it is the legitimate interest in handling the enquiry under Article 6(1)(f). The fields are needed to respond; you can also contact us directly by email or telephone without submitting them.

Netlify Forms receives the form, provides spam protection and stores the message in its own management interface. Notifications are directed to v.peter@smartsquareproductions.com for customer support; the email field may also be used as a reply address. The message is not sent to an AI provider and does not subscribe you to a newsletter. The Netlify information below details the provider's processing and transfer safeguards.

Retention depends on closing the enquiry and whether further handling is necessary. On closure, the operator separately checks whether further retention is required for contractual administration, legal claims or a legal obligation; otherwise, the Netlify copy and customer support email are deleted. There is no automatic deletion task. You can submit a privacy request through the privacy contact below; your rights and complaint options are set out at the end of this notice.

Premium image generation with separate permission

Image generation for the separately approved own admin account uses ShowLane's own OpenAI project and the authorised monthly provider budget. The description, text-based brand details and a separately selected own reference photo are sent to the provider only through an express generation action. For own admin use, the generation button uses the pre-approved monthly budget; customer use requires separate approval of the displayed credit reservation. Typing a description does not initiate a paid call. The finished image goes into your own private media library; the caption and layout can then be edited separately. The operator may also grant gift AI permission tied to an email address: only its owner can use it with a normal Google account and a matching email address verified by Google. You do not have to pay for gift access granted by an admin. Image count, maximum provider budget and expiry separately limit usage; the permission can be revoked. A gift is not an automatic paid subscription or automatic generation. ShowLane's shared monthly provider budget also applies to gifts. Expiry or revocation does not delete content already saved. Paid generation for ordinary customers is not currently active.

Aggregate visit counter

We count new page openings in daily totals. We do not measure individual people, and the counter does not store IP addresses, email addresses, page or referrer URLs, cookies or browser fingerprints. The random technical identifier for a page opening only prevents double counting; each new count deletes identifiers older than the period three calendar days earlier. Daily totals are visible only in the operator's admin interface.

Billing details

We link the billing name, Hungarian address, tax number for business purchases, your account email and electronic invoice choice to your own account. Changing billing details later does not rewrite the snapshot recorded for a payment attempt or an earlier document. Számlázz.hu is provided by KBOSS.hu Kft.; data is sent only to the configured invoicing service. The legal basis is preparing or performing a contract and, for an actual invoice, the legal invoicing obligation. Billing details and document statuses are included in your personal data export. A test-account trial is not a live accounting document. In a configured live flow, an invoice is issued only after server-verified successful payment, with its status available on your Billing page.

Your own customer profiles, website and campaign plans

A verified account can manage up to ten of its own customer profiles. Their branding, media, connections and content belong to separate profiles; the account quota and storage capacity are shared. Selecting a profile does not create sign-in access for another person. The personal data export contains the selected profile's data; a request covering the entire account is recorded separately.

A suggestion requested from your own public website reads the specified HTTPS page on the server, without signing in or cookies. It returns the name, description, source URL and possible colours for review; only a separate selection and save applies them to your branding. Images or logos are not transferred automatically.

A campaign plan stores an offer, target audience, planned budget and application fields in your own profile. It does not collect lead data, launch an advertisement or authorise spending. The operational report aggregates your own publishing, notification and archive receipts; it does not provide automatic audience measurement.

Data, purposes and legal bases

Barion Base Pixel is configured on public pages with our own merchant identifier; the private Studio and billing interfaces open without tracking code. Necessary sign-in emails do not constitute newsletter subscription. ShowLane does not use its own customer data to train models; Premium AI image generation is currently available to the separately authorised own admin account; general customer use is not active.

Local creation and your own audio

Photos, clips, audio tracks, scripts and unsaved plans selected in the browser are processed locally. Your own microphone recording starts only after an express button action and browser permission, for up to 90 seconds. The recording remains available in the local editor until removal or closing the tab; a separately downloaded file stays on your own device. Server storage takes place only through a separate account save or upload.

Browser microphone permission is technical access, not general processing or marketing consent. We do not derive a voice sample for identifying you. Scene captions made from your own text are not automatic audio transcription. Media and text are not sent to an AI provider for free local editing.

Telegram and WhatsApp submissions

Submissions require your own verified recipient and separate enablement. The channel identifier is stored in verification and sending settings; a received event carries hashed sender and event identifiers to prevent duplicate processing. A hash may also be personal data. The photo and a message of up to 2000 characters arrive in your own private inbox; there is no automatic post saving, approval or publication.

A photo can be received only through an authenticated provider media identifier, up to 5 MiB in size. It is fully processed and re-encoded as PNG, removing EXIF and location data. We do not retain the provider's temporary download URL. Up to 20 submissions per hour per channel can be received into your account. Failed or uncertain imports are marked separately and are not automatically repeated.

You can pause submissions in the Studio. Telegram /stop, or WhatsApp STOP or LEÁLLÍTÁS, withdraws the verified recipient's opt-in; after verification again, the previous submission permission must be separately re-enabled. This does not automatically end retention of previously stored material; deletion can be requested on the Account and Data page.

Barion: fraud prevention and optional marketing

When activated with our own Barion identifier, the Base version serves payment fraud prevention on the homepage and public pages that can safely be opened. It may use device and browser identifiers, visit times and digital fingerprints. This fraud prevention purpose is separate from marketing; its legal basis is legitimate interest under GDPR Article 6(1)(f), subject to assessing necessity and documenting the balancing of interests.

Full Pixel's technical integration is enabled for Barion's review of ShowLane's own merchant account. Technical integration does not mean Barion provider approval. Barion's own system manages the review status. Payment and marketing permission are separate from this.

Full Pixel may send Barion public page and offer views, your own package selection, payment steps actually initiated and the server-verified payment result. For signed-in visitors, a normalised SHA-1 hash of the verified email address may also be sent; this may still be personal data. Fraud prevention processing may continue on an appropriate legal basis even if marketing is rejected.

Personalised content, advertisements, offers and related partner data use require separate express marketing consent under GDPR Article 6(1)(a). Marketing is not enabled in advance. You can reject or withdraw your choice at any time through the Privacy Settings button. Withdrawing consent does not affect the lawfulness of consent-based processing before withdrawal.

Barion Payment Zrt. processes Barion Pixel data for the purposes and roles defined in its own notice; for marketing, its listed partners may also process and combine it with other data. A hashed identifier may still be personal data. Authentication URLs, passwords, tokens and private creative content must not be sent. The free preview and PNG export are not purchase events.

Details: Barion's current privacy notice (English), Barion's Hungarian privacy document, Barion media and advertising partners, ShowLane cookies and local storage.

Providers and data transfers

ShowLane's public website is hosted on Netlify; Netlify is also the prepared provider for account database and media storage. At the user's choice, Google (sign-in and a separate Drive connection), Meta (Facebook/Instagram and a separate WhatsApp Business connection), Telegram, LinkedIn and Dropbox may receive data for the relevant action. Approval emails can be sent through the operator's separately configured email provider. Barion's hosted payment page handles payment data in the selected test or live environment; ShowLane does not request or store card numbers.

OpenAI may receive the necessary brief and branding text only through the separate ShowLane project for a separately authorised and configured text or image generation action, and, for a reference-based image request, the user's separately selected own reference photo. A new AI image variant is a new paid action with a maximum credit reservation shown in advance; local caption and layout editing is not such an image request. Local video creation, your own audio recording and rules-based editing previews do not send media to OpenAI. AI video, AI narrators, automatic speech recognition and voice cloning are not activated. Cloud backups can take place only through the selected own Drive/Dropbox connection and a separately authorised action.

The presence of settings is not a provider test and does not prove that your customer account is connected or an action has occurred. After sign-in, Connections and Automation show your personal connection and publication status. Google sign-in does not automatically authorise Google Drive or another channel.

Netlify's published DPA is incorporated into its terms of service by reference. OpenAI's Services Agreement and DPA likewise governs API data processing. These are characteristics of the published agreements; system settings alone do not prove that a particular account has accepted a contract or received separate regional approval. We do not promise exclusive EU storage or zero data retention. The default Netlify Blobs region is us-east-2; Netlify's DPA provides DPF and, where necessary, SCC safeguards for transfers outside the EEA. For EEA customers, OpenAI's DPA relates to the Irish contracting entity and safeguards for transfers outside the EEA. The actual region and any separate retention concession depend on the provider account settings.

Retention and protection

An account and its content are stored while the account is used and until a deletion request is fulfilled. The system records a 30-day target date for handling the request; the statutory response and any justified extension are separate administrative obligations. A verified administrator deletes your sign-in details, sessions, connection tokens, posts, versions, media, video plans and gift AI records through an account-scoped process. The entire own-account media prefix, orphan files and the actual absence of files are also checked. Running, reserved or uncertain provider jobs may prevent completion; the request status then gives a separate reason. Removing external publications, archives or AI-video data requires separate administrator evidence. Deletion does not start new generation or publication. The private completion receipt remains accessible for 90 days after completion; this is the receipt's access period. Pseudonymised deletion records and technical identifiers that limit restoration remain, and there is currently no automatic physical deletion task for them. Where financial records exist, the administrator separately checks the legal basis, policy and deadline for retention and specifies the retained data categories and deadline in the receipt.

A signed-in session expires after 5 minutes of inactivity and the interface signs you out. The presence of a cookie alone does not keep sign-in valid. The system saves supported account editor drafts locally, tied to the account and workspace; after a successful save, you can resume them with the same account. Restoration cannot be guaranteed if local storage is cleared or saving fails. Email confirmation is usable for 1 hour, password reset for 30 minutes and an external connection's initiation state for 10 minutes. Session validity is not a content retention period; expiry does not mean immediate physical deletion of every database record.

The sign-in library processes passwords as cryptographic hashes. Server-side encryption protects external access credentials, and responses contain no key or token. Customer data belongs to separate accounts. Previous sessions are revoked when a password is reset.

Provider logs and backups

Verification of local deletion covers the active ShowLane database and own media library; it does not prove immediate destruction of provider backups. Under the published Netlify Database backup policy and ShowLane's current verified Personal plan, daily database backups are retained for 7 days, while the last 3 deployment-linked backups are retained; the latter is a count, not a general time limit. Restoring a backup requires a separate privacy review.

The published OpenAI API defaults state that API content is not used for model training without a separate data-sharing opt-in. Abuse monitoring logs for text and image endpoints may by default be retained for up to 30 days, subject to legal and security exceptions; for example, flagged image inputs may be retained longer for manual review. ShowLane disables application-state storage for its text API calls; this does not remove abuse monitoring log retention. Separate file storage may have a different retention period. ShowLane does not claim approved ZDR or exclusive EU-region settings here and does not promise immediate deletion of provider security logs.

Retention of media and submissions

Image, video and audio files, video plans, scripts and captions saved to an account remain in its own media library. Saving a video plan creates a new file; it does not delete the earlier plan. Submissions, including records of failed or uncertain processing, are also stored. The list of the 50 most recent submissions and the hourly reception limit of 20 are not retention or deletion deadlines.

A recipient verification link is usable for 15 minutes and a content approval link for 48 hours. Expiry ends use of the link; it does not physically delete the decision or content snapshot. Stopping automation or disconnecting a service does not automatically delete earlier content, archives created in external storage or posts already published by a social provider. Removal must be handled separately; the beta does not promise automatic complete erasure or a final provider retention period.

Your rights and requests

You can request access, rectification, erasure and restriction; depending on the legal basis, you may object and request data portability. On the Account and Data page, you can download your own data as JSON and record a request with an identifier. This does not mean automatic fulfilment. The operator responds without undue delay, generally within one month, and informs you of a justified extension within the statutory time limit.

You can complain to the Hungarian National Authority for Data Protection and Freedom of Information: NAIH, 1055 Budapest, Falk Miksa utca 9–11., ugyfelszolgalat@naih.hu. Judicial remedies are also available.

What is included in your personal data export?

In addition to earlier account, post and version data, the authenticated personal data JSON includes your own received messages and photo references, submission settings, automation decisions and publication statuses, your own usage quotas and verified saved video plans. A video plan includes its script, captions and scene/audio settings. If a saved plan cannot be read and verified, it is marked separately and requires handling.

The JSON does not contain raw video, image or audio bytes. You can download files separately from your own media library and, if needed, request further access through the privacy contact. Access and approval secrets are not included in the export. Downloading does not delete data.